Team Management

Team management lets you control who has access to your LostChurn account and what they can do. Invite team members, assign roles with granular permissions, and track every action with audit logging. Team management is available on all tiers with varying team member limits.

Team Member Limits by Tier

Roles

LostChurn provides four predefined roles. Each team member is assigned exactly one role.

Owner

The account creator. There is exactly one Owner per account. The Owner has full access to everything and is the only role that can:

• Delete the account
• Transfer ownership to another team member
• Manage billing and subscription
• Access API key management

Admin

Full operational access without billing or account deletion capabilities. Admins can manage team members, configure integrations, and modify all recovery and campaign settings.

Member

Day-to-day operational access. Members can create and edit campaigns, view analytics, and manage customer records, but cannot change account settings or manage other team members.

Viewer

Read-only access. Viewers can see dashboards, analytics, customer records, and campaign results, but cannot create, edit, or delete anything.

Permissions Matrix

Inviting Team Members

Sending an Invitation

1. Navigate to Settings > Team
2. Click Invite Member
3. Enter the team member's email address
4. Select a role (Admin, Member, or Viewer)
5. Click Send Invitation

The invitee receives an email with a link to accept the invitation and create their LostChurn account (or link their existing account).

Invitation States

Resending or Revoking Invitations

From the Team settings page:

• Click Resend next to a pending invitation to send a new email (resets the 7-day expiry)
• Click Revoke to cancel a pending invitation

Removing Team Members

1. Navigate to Settings > Team
2. Find the team member you want to remove
3. Click the ... menu and select Remove
4. Confirm the removal in the dialog

When a team member is removed:

• Their access is revoked immediately
• Their active sessions are terminated
• Campaigns and templates they created remain intact
• Their actions remain in the audit log with their name attached

Transferring Ownership

Only the current Owner can transfer ownership:

1. Navigate to Settings > Team
2. Click Transfer Ownership
3. Select the team member who will become the new Owner (must be an Admin)
4. Enter your password to confirm
5. The selected team member becomes the Owner; you become an Admin

Ownership transfer is immediate and cannot be undone without the new Owner's cooperation.

SSO/SAML (Enterprise Only)

Enterprise customers can configure Single Sign-On using SAML 2.0 to enforce centralized authentication through their identity provider (IdP).

Supported Identity Providers

LostChurn has been tested with the following IdPs:

• Okta
• Azure Active Directory (Entra ID)
• Google Workspace
• OneLogin
• PingFederate
• JumpCloud

Other SAML 2.0-compliant IdPs should work but are not officially supported.

Configuration

1. Navigate to Settings > Security > SSO
2. Click Configure SAML
3. Enter the following from your IdP:
   • SSO URL — The IdP's SAML endpoint
   • Entity ID — The IdP's entity identifier
   • Certificate — The IdP's X.509 signing certificate
4. Copy the LostChurn ACS URL and SP Entity ID into your IdP configuration
5. Click Test Connection to validate the setup
6. Enable Require SSO to enforce SAML authentication for all team members

SAML Attributes

LostChurn expects the following SAML attributes in the assertion:

If the role attribute is provided, LostChurn automatically assigns the specified role to new team members who sign in via SSO. If omitted, new SSO users are assigned the Member role by default.

Just-in-Time Provisioning

When SSO is enabled, team members who authenticate through your IdP for the first time are automatically provisioned in LostChurn:

• No invitation is needed
• They receive the role specified in the SAML role attribute (or Member by default)
• They count toward your team member limit
• JIT provisioning can be disabled if you prefer to manage invitations manually

Enforcing SSO

When Require SSO is enabled:

• All team members must authenticate through the IdP
• Password-based login is disabled for all non-Owner accounts
• The Owner retains password access as a break-glass mechanism
• Existing sessions for non-SSO users are terminated

Audit Logging

Every team action in LostChurn is recorded in the audit log, providing a complete trail of who did what and when.

What Is Logged

Viewing the Audit Log

1. Navigate to Settings > Security > Audit Log
2. Browse the chronological list of events
3. Use filters to narrow by:
   • Team member — Actions by a specific person
   • Category — Authentication, campaigns, settings, etc.
   • Date range — Events within a specific time window

Audit Log Entry Format

Each entry includes:

• Timestamp — When the action occurred (in your account's timezone)
• Actor — The team member who performed the action
• Action — What was done (e.g., "Created campaign", "Removed team member")
• Target — The object affected (e.g., campaign name, team member email)
• Details — Additional context (e.g., changed fields, old and new values)
• IP Address — The actor's IP address

Retention

Audit logs are retained based on your tier:

Exporting Audit Logs

Enterprise customers can export audit logs as CSV or JSON:

1. Navigate to Settings > Security > Audit Log
2. Apply any desired filters
3. Click Export
4. Select the format (CSV or JSON)
5. The export runs as a background job; you will be notified when it is ready

What's Next

• Security Overview — Learn about LostChurn's security practices and certifications
• Usage Limits — Understand team member limits and other tier-based quotas